NocoBase is vulnerable to authenticated remote code execution through two chained flaws in the server package. An authenticated admin can supply an unsanitized documentRoot value to the storages:update API to redirect the file-upload storage root to an arbitrary path on disk, including the application directory (arbitrary file write). The same admin can then trigger a Node.js require() on any absolute filesystem path via the pm:enable plugin manager endpoint, which accepts user-supplied paths with no validation (local file inclusion). Chained, these allow writing a malicious file and executing it. Fixed in 2.1.5.